full-disclosure - [USN-1015-1] libvpx vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1289411108.6452.0.camel@luna>
Date: Wed, 10 Nov 2010 11:45:08 -0600
From: Jamie Strandboge <jamie@...onical.com>
To: ubuntu-security-announce <ubuntu-security-announce@...ts.ubuntu.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	bugtraq@...urityfocus.com
Subject: [USN-1015-1] libvpx vulnerability

===========================================================
Ubuntu Security Notice USN-1015-1          November 10, 2010
libvpx vulnerability
CVE-2010-4203
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 10.10:
  libvpx0                         0.9.2-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

Details follow:

Christoph Diehl discovered that libvpx did not properly perform bounds
checking. If an application using libvpx opened a specially crafted
WebM file, an attacker could cause a denial of service or possibly execute
code as the user invoking the program.


Updated packages for Ubuntu 10.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx_0.9.2-1ubuntu0.1.debian.tar.gz
      Size/MD5:    11216 71651eb86d66635c6762bfbd09fc2dbe
    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx_0.9.2-1ubuntu0.1.dsc
      Size/MD5:     1915 acc3a3df81a1d44128642b82efd87500
    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx_0.9.2.orig.tar.bz2
      Size/MD5:  1197094 609370925b274aeaa29e94fc34c74957

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx-doc_0.9.2-1ubuntu0.1_all.deb
      Size/MD5:   213800 643f6dec01f57f032e3b0569fd740aea

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx-dev_0.9.2-1ubuntu0.1_amd64.deb
      Size/MD5:   317232 2bba15922882c45e09e00734cba97992
    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx0-dbg_0.9.2-1ubuntu0.1_amd64.deb
      Size/MD5:   513174 e7e4950eaeb1451d3b65877ee6160740
    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx0_0.9.2-1ubuntu0.1_amd64.deb
      Size/MD5:   242484 29757fcd05cb208a7417c80c0e1480be

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx-dev_0.9.2-1ubuntu0.1_i386.deb
      Size/MD5:   295092 ad95c819c44989c1dffe857e8f5d7756
    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx0-dbg_0.9.2-1ubuntu0.1_i386.deb
      Size/MD5:   482832 47d4ef6d2a62ee070301fe4b5872acd2
    http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx0_0.9.2-1ubuntu0.1_i386.deb
      Size/MD5:   221952 7ff75df2f1410385b6231d633eceeaec

  armel architecture (ARM Architecture):

    http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx-dev_0.9.2-1ubuntu0.1_armel.deb
      Size/MD5:   303772 a28b374676f0b28fb74cabea30cca822
    http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx0-dbg_0.9.2-1ubuntu0.1_armel.deb
      Size/MD5:   462142 a59e1096f88f18a844e37fabc99d1d7f
    http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx0_0.9.2-1ubuntu0.1_armel.deb
      Size/MD5:   244498 5bc6ca696e39ddc9af21a30856ff2177

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx-dev_0.9.2-1ubuntu0.1_powerpc.deb
      Size/MD5:   279168 25295c9264836bdace7133836a634afb
    http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx0-dbg_0.9.2-1ubuntu0.1_powerpc.deb
      Size/MD5:   452792 c9c51d0c479379b19e77022992eb76ac
    http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx0_0.9.2-1ubuntu0.1_powerpc.deb
      Size/MD5:   218026 e4618be5cbce6571eae4810c9e80990f




Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/